Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
04/08/2023, 15:28
Static task
static1
Behavioral task
behavioral1
Sample
5ad713cec657640baf1b492a94a37afd_mafia_JC.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
5ad713cec657640baf1b492a94a37afd_mafia_JC.exe
Resource
win10v2004-20230703-en
General
-
Target
5ad713cec657640baf1b492a94a37afd_mafia_JC.exe
-
Size
487KB
-
MD5
5ad713cec657640baf1b492a94a37afd
-
SHA1
ef47ba5fc7b4f66281fda6132ef91985458faa9e
-
SHA256
9aea6dd169ad0dcbe4e9d8e83ae275b70f09008422c7e7bfa3e3508002f0d4e8
-
SHA512
6580660f281814e82e63ff0ad6f5c2a1cdd78fe176735afade2692fb50426599c5da5e6e75262099347043e69943485b0fb580405f510596cf71ef3a8a88be42
-
SSDEEP
6144:qorf3lPvovsgZnqG2C7mOTeiL9DUAMF/jMdAnyNVs1GVPdeLs68Fhne5ppExMoiH:HU5rCOTeiJan2w75p/NZ
Malware Config
Signatures
-
Executes dropped EXE 64 IoCs
pid Process 832 C30.tmp 3464 CFB.tmp 4296 D97.tmp 5104 E91.tmp 4404 F4D.tmp 1036 FF9.tmp 380 10D4.tmp 1644 1170.tmp 4244 1661.tmp 3096 16CF.tmp 416 17B9.tmp 4688 1884.tmp 3372 196F.tmp 4056 1A1B.tmp 4436 1B05.tmp 4444 1BB1.tmp 3916 1C4D.tmp 4832 1CF9.tmp 440 1DF3.tmp 3984 1EED.tmp 4544 1FC8.tmp 3844 20A2.tmp 2160 212F.tmp 3868 220A.tmp 4748 22A6.tmp 3784 2352.tmp 1788 23EE.tmp 928 248A.tmp 4016 2594.tmp 2252 265F.tmp 3896 27A7.tmp 2360 2872.tmp 4116 293E.tmp 1796 29E9.tmp 376 2A76.tmp 1500 2B03.tmp 2000 2B8F.tmp 4316 2C0C.tmp 4392 2CA9.tmp 3620 2D35.tmp 1128 2DE1.tmp 5004 2E7D.tmp 2612 2F1A.tmp 224 2FA6.tmp 3728 3052.tmp 2732 30DF.tmp 1212 31AA.tmp 3112 3246.tmp 2720 3302.tmp 956 339E.tmp 2236 344A.tmp 3188 34C7.tmp 4664 3573.tmp 3576 361E.tmp 4088 36CA.tmp 1388 3767.tmp 2168 3803.tmp 3496 38BE.tmp 2772 396A.tmp 1944 39D8.tmp 3344 3A55.tmp 3560 3AD2.tmp 4940 3B4F.tmp 4244 3BAC.tmp -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1240 wrote to memory of 832 1240 5ad713cec657640baf1b492a94a37afd_mafia_JC.exe 80 PID 1240 wrote to memory of 832 1240 5ad713cec657640baf1b492a94a37afd_mafia_JC.exe 80 PID 1240 wrote to memory of 832 1240 5ad713cec657640baf1b492a94a37afd_mafia_JC.exe 80 PID 832 wrote to memory of 3464 832 C30.tmp 81 PID 832 wrote to memory of 3464 832 C30.tmp 81 PID 832 wrote to memory of 3464 832 C30.tmp 81 PID 3464 wrote to memory of 4296 3464 CFB.tmp 82 PID 3464 wrote to memory of 4296 3464 CFB.tmp 82 PID 3464 wrote to memory of 4296 3464 CFB.tmp 82 PID 4296 wrote to memory of 5104 4296 D97.tmp 83 PID 4296 wrote to memory of 5104 4296 D97.tmp 83 PID 4296 wrote to memory of 5104 4296 D97.tmp 83 PID 5104 wrote to memory of 4404 5104 E91.tmp 84 PID 5104 wrote to memory of 4404 5104 E91.tmp 84 PID 5104 wrote to memory of 4404 5104 E91.tmp 84 PID 4404 wrote to memory of 1036 4404 F4D.tmp 85 PID 4404 wrote to memory of 1036 4404 F4D.tmp 85 PID 4404 wrote to memory of 1036 4404 F4D.tmp 85 PID 1036 wrote to memory of 380 1036 FF9.tmp 86 PID 1036 wrote to memory of 380 1036 FF9.tmp 86 PID 1036 wrote to memory of 380 1036 FF9.tmp 86 PID 380 wrote to memory of 1644 380 10D4.tmp 87 PID 380 wrote to memory of 1644 380 10D4.tmp 87 PID 380 wrote to memory of 1644 380 10D4.tmp 87 PID 1644 wrote to memory of 4244 1644 1170.tmp 89 PID 1644 wrote to memory of 4244 1644 1170.tmp 89 PID 1644 wrote to memory of 4244 1644 1170.tmp 89 PID 4244 wrote to memory of 3096 4244 1661.tmp 90 PID 4244 wrote to memory of 3096 4244 1661.tmp 90 PID 4244 wrote to memory of 3096 4244 1661.tmp 90 PID 3096 wrote to memory of 416 3096 16CF.tmp 91 PID 3096 wrote to memory of 416 3096 16CF.tmp 91 PID 3096 wrote to memory of 416 3096 16CF.tmp 91 PID 416 wrote to memory of 4688 416 17B9.tmp 92 PID 416 wrote to memory of 4688 416 17B9.tmp 92 PID 416 wrote to memory of 4688 416 17B9.tmp 92 PID 4688 wrote to memory of 3372 4688 1884.tmp 93 PID 4688 wrote to memory of 3372 4688 1884.tmp 93 PID 4688 wrote to memory of 3372 4688 1884.tmp 93 PID 3372 wrote to memory of 4056 3372 196F.tmp 94 PID 3372 wrote to memory of 4056 3372 196F.tmp 94 PID 3372 wrote to memory of 4056 3372 196F.tmp 94 PID 4056 wrote to memory of 4436 4056 1A1B.tmp 95 PID 4056 wrote to memory of 4436 4056 1A1B.tmp 95 PID 4056 wrote to memory of 4436 4056 1A1B.tmp 95 PID 4436 wrote to memory of 4444 4436 1B05.tmp 96 PID 4436 wrote to memory of 4444 4436 1B05.tmp 96 PID 4436 wrote to memory of 4444 4436 1B05.tmp 96 PID 4444 wrote to memory of 3916 4444 1BB1.tmp 99 PID 4444 wrote to memory of 3916 4444 1BB1.tmp 99 PID 4444 wrote to memory of 3916 4444 1BB1.tmp 99 PID 3916 wrote to memory of 4832 3916 1C4D.tmp 100 PID 3916 wrote to memory of 4832 3916 1C4D.tmp 100 PID 3916 wrote to memory of 4832 3916 1C4D.tmp 100 PID 4832 wrote to memory of 440 4832 1CF9.tmp 101 PID 4832 wrote to memory of 440 4832 1CF9.tmp 101 PID 4832 wrote to memory of 440 4832 1CF9.tmp 101 PID 440 wrote to memory of 3984 440 1DF3.tmp 102 PID 440 wrote to memory of 3984 440 1DF3.tmp 102 PID 440 wrote to memory of 3984 440 1DF3.tmp 102 PID 3984 wrote to memory of 4544 3984 1EED.tmp 103 PID 3984 wrote to memory of 4544 3984 1EED.tmp 103 PID 3984 wrote to memory of 4544 3984 1EED.tmp 103 PID 4544 wrote to memory of 3844 4544 1FC8.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\5ad713cec657640baf1b492a94a37afd_mafia_JC.exe"C:\Users\Admin\AppData\Local\Temp\5ad713cec657640baf1b492a94a37afd_mafia_JC.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Users\Admin\AppData\Local\Temp\C30.tmp"C:\Users\Admin\AppData\Local\Temp\C30.tmp"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Users\Admin\AppData\Local\Temp\CFB.tmp"C:\Users\Admin\AppData\Local\Temp\CFB.tmp"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3464 -
C:\Users\Admin\AppData\Local\Temp\D97.tmp"C:\Users\Admin\AppData\Local\Temp\D97.tmp"4⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\E91.tmp"C:\Users\Admin\AppData\Local\Temp\E91.tmp"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Users\Admin\AppData\Local\Temp\F4D.tmp"C:\Users\Admin\AppData\Local\Temp\F4D.tmp"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Local\Temp\FF9.tmp"C:\Users\Admin\AppData\Local\Temp\FF9.tmp"7⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Users\Admin\AppData\Local\Temp\10D4.tmp"C:\Users\Admin\AppData\Local\Temp\10D4.tmp"8⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:380 -
C:\Users\Admin\AppData\Local\Temp\1170.tmp"C:\Users\Admin\AppData\Local\Temp\1170.tmp"9⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\1661.tmp"C:\Users\Admin\AppData\Local\Temp\1661.tmp"10⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\16CF.tmp"C:\Users\Admin\AppData\Local\Temp\16CF.tmp"11⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\17B9.tmp"C:\Users\Admin\AppData\Local\Temp\17B9.tmp"12⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:416 -
C:\Users\Admin\AppData\Local\Temp\1884.tmp"C:\Users\Admin\AppData\Local\Temp\1884.tmp"13⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Users\Admin\AppData\Local\Temp\196F.tmp"C:\Users\Admin\AppData\Local\Temp\196F.tmp"14⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Users\Admin\AppData\Local\Temp\1A1B.tmp"C:\Users\Admin\AppData\Local\Temp\1A1B.tmp"15⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\1B05.tmp"C:\Users\Admin\AppData\Local\Temp\1B05.tmp"16⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\1BB1.tmp"C:\Users\Admin\AppData\Local\Temp\1BB1.tmp"17⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4444 -
C:\Users\Admin\AppData\Local\Temp\1C4D.tmp"C:\Users\Admin\AppData\Local\Temp\1C4D.tmp"18⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\1CF9.tmp"C:\Users\Admin\AppData\Local\Temp\1CF9.tmp"19⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\1DF3.tmp"C:\Users\Admin\AppData\Local\Temp\1DF3.tmp"20⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Users\Admin\AppData\Local\Temp\1EED.tmp"C:\Users\Admin\AppData\Local\Temp\1EED.tmp"21⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3984 -
C:\Users\Admin\AppData\Local\Temp\1FC8.tmp"C:\Users\Admin\AppData\Local\Temp\1FC8.tmp"22⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4544 -
C:\Users\Admin\AppData\Local\Temp\20A2.tmp"C:\Users\Admin\AppData\Local\Temp\20A2.tmp"23⤵
- Executes dropped EXE
PID:3844 -
C:\Users\Admin\AppData\Local\Temp\212F.tmp"C:\Users\Admin\AppData\Local\Temp\212F.tmp"24⤵
- Executes dropped EXE
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\220A.tmp"C:\Users\Admin\AppData\Local\Temp\220A.tmp"25⤵
- Executes dropped EXE
PID:3868 -
C:\Users\Admin\AppData\Local\Temp\22A6.tmp"C:\Users\Admin\AppData\Local\Temp\22A6.tmp"26⤵
- Executes dropped EXE
PID:4748 -
C:\Users\Admin\AppData\Local\Temp\2352.tmp"C:\Users\Admin\AppData\Local\Temp\2352.tmp"27⤵
- Executes dropped EXE
PID:3784 -
C:\Users\Admin\AppData\Local\Temp\23EE.tmp"C:\Users\Admin\AppData\Local\Temp\23EE.tmp"28⤵
- Executes dropped EXE
PID:1788 -
C:\Users\Admin\AppData\Local\Temp\248A.tmp"C:\Users\Admin\AppData\Local\Temp\248A.tmp"29⤵
- Executes dropped EXE
PID:928 -
C:\Users\Admin\AppData\Local\Temp\2594.tmp"C:\Users\Admin\AppData\Local\Temp\2594.tmp"30⤵
- Executes dropped EXE
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\265F.tmp"C:\Users\Admin\AppData\Local\Temp\265F.tmp"31⤵
- Executes dropped EXE
PID:2252 -
C:\Users\Admin\AppData\Local\Temp\27A7.tmp"C:\Users\Admin\AppData\Local\Temp\27A7.tmp"32⤵
- Executes dropped EXE
PID:3896 -
C:\Users\Admin\AppData\Local\Temp\2872.tmp"C:\Users\Admin\AppData\Local\Temp\2872.tmp"33⤵
- Executes dropped EXE
PID:2360 -
C:\Users\Admin\AppData\Local\Temp\293E.tmp"C:\Users\Admin\AppData\Local\Temp\293E.tmp"34⤵
- Executes dropped EXE
PID:4116 -
C:\Users\Admin\AppData\Local\Temp\29E9.tmp"C:\Users\Admin\AppData\Local\Temp\29E9.tmp"35⤵
- Executes dropped EXE
PID:1796 -
C:\Users\Admin\AppData\Local\Temp\2A76.tmp"C:\Users\Admin\AppData\Local\Temp\2A76.tmp"36⤵
- Executes dropped EXE
PID:376 -
C:\Users\Admin\AppData\Local\Temp\2B03.tmp"C:\Users\Admin\AppData\Local\Temp\2B03.tmp"37⤵
- Executes dropped EXE
PID:1500 -
C:\Users\Admin\AppData\Local\Temp\2B8F.tmp"C:\Users\Admin\AppData\Local\Temp\2B8F.tmp"38⤵
- Executes dropped EXE
PID:2000 -
C:\Users\Admin\AppData\Local\Temp\2C0C.tmp"C:\Users\Admin\AppData\Local\Temp\2C0C.tmp"39⤵
- Executes dropped EXE
PID:4316 -
C:\Users\Admin\AppData\Local\Temp\2CA9.tmp"C:\Users\Admin\AppData\Local\Temp\2CA9.tmp"40⤵
- Executes dropped EXE
PID:4392 -
C:\Users\Admin\AppData\Local\Temp\2D35.tmp"C:\Users\Admin\AppData\Local\Temp\2D35.tmp"41⤵
- Executes dropped EXE
PID:3620 -
C:\Users\Admin\AppData\Local\Temp\2DE1.tmp"C:\Users\Admin\AppData\Local\Temp\2DE1.tmp"42⤵
- Executes dropped EXE
PID:1128 -
C:\Users\Admin\AppData\Local\Temp\2E7D.tmp"C:\Users\Admin\AppData\Local\Temp\2E7D.tmp"43⤵
- Executes dropped EXE
PID:5004 -
C:\Users\Admin\AppData\Local\Temp\2F1A.tmp"C:\Users\Admin\AppData\Local\Temp\2F1A.tmp"44⤵
- Executes dropped EXE
PID:2612 -
C:\Users\Admin\AppData\Local\Temp\2FA6.tmp"C:\Users\Admin\AppData\Local\Temp\2FA6.tmp"45⤵
- Executes dropped EXE
PID:224 -
C:\Users\Admin\AppData\Local\Temp\3052.tmp"C:\Users\Admin\AppData\Local\Temp\3052.tmp"46⤵
- Executes dropped EXE
PID:3728 -
C:\Users\Admin\AppData\Local\Temp\30DF.tmp"C:\Users\Admin\AppData\Local\Temp\30DF.tmp"47⤵
- Executes dropped EXE
PID:2732 -
C:\Users\Admin\AppData\Local\Temp\31AA.tmp"C:\Users\Admin\AppData\Local\Temp\31AA.tmp"48⤵
- Executes dropped EXE
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\3246.tmp"C:\Users\Admin\AppData\Local\Temp\3246.tmp"49⤵
- Executes dropped EXE
PID:3112 -
C:\Users\Admin\AppData\Local\Temp\3302.tmp"C:\Users\Admin\AppData\Local\Temp\3302.tmp"50⤵
- Executes dropped EXE
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\339E.tmp"C:\Users\Admin\AppData\Local\Temp\339E.tmp"51⤵
- Executes dropped EXE
PID:956 -
C:\Users\Admin\AppData\Local\Temp\344A.tmp"C:\Users\Admin\AppData\Local\Temp\344A.tmp"52⤵
- Executes dropped EXE
PID:2236 -
C:\Users\Admin\AppData\Local\Temp\34C7.tmp"C:\Users\Admin\AppData\Local\Temp\34C7.tmp"53⤵
- Executes dropped EXE
PID:3188 -
C:\Users\Admin\AppData\Local\Temp\3573.tmp"C:\Users\Admin\AppData\Local\Temp\3573.tmp"54⤵
- Executes dropped EXE
PID:4664 -
C:\Users\Admin\AppData\Local\Temp\361E.tmp"C:\Users\Admin\AppData\Local\Temp\361E.tmp"55⤵
- Executes dropped EXE
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\36CA.tmp"C:\Users\Admin\AppData\Local\Temp\36CA.tmp"56⤵
- Executes dropped EXE
PID:4088 -
C:\Users\Admin\AppData\Local\Temp\3767.tmp"C:\Users\Admin\AppData\Local\Temp\3767.tmp"57⤵
- Executes dropped EXE
PID:1388 -
C:\Users\Admin\AppData\Local\Temp\3803.tmp"C:\Users\Admin\AppData\Local\Temp\3803.tmp"58⤵
- Executes dropped EXE
PID:2168 -
C:\Users\Admin\AppData\Local\Temp\38BE.tmp"C:\Users\Admin\AppData\Local\Temp\38BE.tmp"59⤵
- Executes dropped EXE
PID:3496 -
C:\Users\Admin\AppData\Local\Temp\396A.tmp"C:\Users\Admin\AppData\Local\Temp\396A.tmp"60⤵
- Executes dropped EXE
PID:2772 -
C:\Users\Admin\AppData\Local\Temp\39D8.tmp"C:\Users\Admin\AppData\Local\Temp\39D8.tmp"61⤵
- Executes dropped EXE
PID:1944 -
C:\Users\Admin\AppData\Local\Temp\3A55.tmp"C:\Users\Admin\AppData\Local\Temp\3A55.tmp"62⤵
- Executes dropped EXE
PID:3344 -
C:\Users\Admin\AppData\Local\Temp\3AD2.tmp"C:\Users\Admin\AppData\Local\Temp\3AD2.tmp"63⤵
- Executes dropped EXE
PID:3560 -
C:\Users\Admin\AppData\Local\Temp\3B4F.tmp"C:\Users\Admin\AppData\Local\Temp\3B4F.tmp"64⤵
- Executes dropped EXE
PID:4940 -
C:\Users\Admin\AppData\Local\Temp\3BAC.tmp"C:\Users\Admin\AppData\Local\Temp\3BAC.tmp"65⤵
- Executes dropped EXE
PID:4244 -
C:\Users\Admin\AppData\Local\Temp\3C29.tmp"C:\Users\Admin\AppData\Local\Temp\3C29.tmp"66⤵PID:1956
-
C:\Users\Admin\AppData\Local\Temp\3CA6.tmp"C:\Users\Admin\AppData\Local\Temp\3CA6.tmp"67⤵PID:2508
-
C:\Users\Admin\AppData\Local\Temp\3D33.tmp"C:\Users\Admin\AppData\Local\Temp\3D33.tmp"68⤵PID:1028
-
C:\Users\Admin\AppData\Local\Temp\3DC0.tmp"C:\Users\Admin\AppData\Local\Temp\3DC0.tmp"69⤵PID:4152
-
C:\Users\Admin\AppData\Local\Temp\3E1D.tmp"C:\Users\Admin\AppData\Local\Temp\3E1D.tmp"70⤵PID:5012
-
C:\Users\Admin\AppData\Local\Temp\3EAA.tmp"C:\Users\Admin\AppData\Local\Temp\3EAA.tmp"71⤵PID:2576
-
C:\Users\Admin\AppData\Local\Temp\3F46.tmp"C:\Users\Admin\AppData\Local\Temp\3F46.tmp"72⤵PID:4056
-
C:\Users\Admin\AppData\Local\Temp\3FD3.tmp"C:\Users\Admin\AppData\Local\Temp\3FD3.tmp"73⤵PID:4700
-
C:\Users\Admin\AppData\Local\Temp\410B.tmp"C:\Users\Admin\AppData\Local\Temp\410B.tmp"74⤵PID:1952
-
C:\Users\Admin\AppData\Local\Temp\4188.tmp"C:\Users\Admin\AppData\Local\Temp\4188.tmp"75⤵PID:4580
-
C:\Users\Admin\AppData\Local\Temp\4225.tmp"C:\Users\Admin\AppData\Local\Temp\4225.tmp"76⤵PID:1896
-
C:\Users\Admin\AppData\Local\Temp\42D0.tmp"C:\Users\Admin\AppData\Local\Temp\42D0.tmp"77⤵PID:3712
-
C:\Users\Admin\AppData\Local\Temp\434D.tmp"C:\Users\Admin\AppData\Local\Temp\434D.tmp"78⤵PID:4364
-
C:\Users\Admin\AppData\Local\Temp\43CA.tmp"C:\Users\Admin\AppData\Local\Temp\43CA.tmp"79⤵PID:2524
-
C:\Users\Admin\AppData\Local\Temp\4428.tmp"C:\Users\Admin\AppData\Local\Temp\4428.tmp"80⤵PID:4544
-
C:\Users\Admin\AppData\Local\Temp\44B5.tmp"C:\Users\Admin\AppData\Local\Temp\44B5.tmp"81⤵PID:3844
-
C:\Users\Admin\AppData\Local\Temp\4551.tmp"C:\Users\Admin\AppData\Local\Temp\4551.tmp"82⤵PID:1784
-
C:\Users\Admin\AppData\Local\Temp\45CE.tmp"C:\Users\Admin\AppData\Local\Temp\45CE.tmp"83⤵PID:3868
-
C:\Users\Admin\AppData\Local\Temp\464B.tmp"C:\Users\Admin\AppData\Local\Temp\464B.tmp"84⤵PID:4740
-
C:\Users\Admin\AppData\Local\Temp\46B8.tmp"C:\Users\Admin\AppData\Local\Temp\46B8.tmp"85⤵PID:3624
-
C:\Users\Admin\AppData\Local\Temp\4745.tmp"C:\Users\Admin\AppData\Local\Temp\4745.tmp"86⤵PID:544
-
C:\Users\Admin\AppData\Local\Temp\47D2.tmp"C:\Users\Admin\AppData\Local\Temp\47D2.tmp"87⤵PID:1788
-
C:\Users\Admin\AppData\Local\Temp\487E.tmp"C:\Users\Admin\AppData\Local\Temp\487E.tmp"88⤵PID:212
-
C:\Users\Admin\AppData\Local\Temp\490A.tmp"C:\Users\Admin\AppData\Local\Temp\490A.tmp"89⤵PID:1572
-
C:\Users\Admin\AppData\Local\Temp\4997.tmp"C:\Users\Admin\AppData\Local\Temp\4997.tmp"90⤵PID:4388
-
C:\Users\Admin\AppData\Local\Temp\4A14.tmp"C:\Users\Admin\AppData\Local\Temp\4A14.tmp"91⤵PID:4652
-
C:\Users\Admin\AppData\Local\Temp\4AC0.tmp"C:\Users\Admin\AppData\Local\Temp\4AC0.tmp"92⤵PID:4676
-
C:\Users\Admin\AppData\Local\Temp\4B5C.tmp"C:\Users\Admin\AppData\Local\Temp\4B5C.tmp"93⤵PID:4164
-
C:\Users\Admin\AppData\Local\Temp\4BD9.tmp"C:\Users\Admin\AppData\Local\Temp\4BD9.tmp"94⤵PID:2264
-
C:\Users\Admin\AppData\Local\Temp\4C66.tmp"C:\Users\Admin\AppData\Local\Temp\4C66.tmp"95⤵PID:4116
-
C:\Users\Admin\AppData\Local\Temp\4D02.tmp"C:\Users\Admin\AppData\Local\Temp\4D02.tmp"96⤵PID:2496
-
C:\Users\Admin\AppData\Local\Temp\4DAE.tmp"C:\Users\Admin\AppData\Local\Temp\4DAE.tmp"97⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\4E4A.tmp"C:\Users\Admin\AppData\Local\Temp\4E4A.tmp"98⤵PID:3508
-
C:\Users\Admin\AppData\Local\Temp\4F05.tmp"C:\Users\Admin\AppData\Local\Temp\4F05.tmp"99⤵PID:2000
-
C:\Users\Admin\AppData\Local\Temp\4F92.tmp"C:\Users\Admin\AppData\Local\Temp\4F92.tmp"100⤵PID:4316
-
C:\Users\Admin\AppData\Local\Temp\501F.tmp"C:\Users\Admin\AppData\Local\Temp\501F.tmp"101⤵PID:2272
-
C:\Users\Admin\AppData\Local\Temp\50AB.tmp"C:\Users\Admin\AppData\Local\Temp\50AB.tmp"102⤵PID:3352
-
C:\Users\Admin\AppData\Local\Temp\5148.tmp"C:\Users\Admin\AppData\Local\Temp\5148.tmp"103⤵PID:3512
-
C:\Users\Admin\AppData\Local\Temp\51F3.tmp"C:\Users\Admin\AppData\Local\Temp\51F3.tmp"104⤵PID:1380
-
C:\Users\Admin\AppData\Local\Temp\5290.tmp"C:\Users\Admin\AppData\Local\Temp\5290.tmp"105⤵PID:3064
-
C:\Users\Admin\AppData\Local\Temp\533C.tmp"C:\Users\Admin\AppData\Local\Temp\533C.tmp"106⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\53E7.tmp"C:\Users\Admin\AppData\Local\Temp\53E7.tmp"107⤵PID:5000
-
C:\Users\Admin\AppData\Local\Temp\5493.tmp"C:\Users\Admin\AppData\Local\Temp\5493.tmp"108⤵PID:3700
-
C:\Users\Admin\AppData\Local\Temp\5510.tmp"C:\Users\Admin\AppData\Local\Temp\5510.tmp"109⤵PID:4372
-
C:\Users\Admin\AppData\Local\Temp\55AD.tmp"C:\Users\Admin\AppData\Local\Temp\55AD.tmp"110⤵PID:3776
-
C:\Users\Admin\AppData\Local\Temp\5658.tmp"C:\Users\Admin\AppData\Local\Temp\5658.tmp"111⤵PID:2440
-
C:\Users\Admin\AppData\Local\Temp\56F5.tmp"C:\Users\Admin\AppData\Local\Temp\56F5.tmp"112⤵PID:3596
-
C:\Users\Admin\AppData\Local\Temp\5781.tmp"C:\Users\Admin\AppData\Local\Temp\5781.tmp"113⤵PID:3764
-
C:\Users\Admin\AppData\Local\Temp\581E.tmp"C:\Users\Admin\AppData\Local\Temp\581E.tmp"114⤵PID:4228
-
C:\Users\Admin\AppData\Local\Temp\58BA.tmp"C:\Users\Admin\AppData\Local\Temp\58BA.tmp"115⤵PID:1348
-
C:\Users\Admin\AppData\Local\Temp\5956.tmp"C:\Users\Admin\AppData\Local\Temp\5956.tmp"116⤵PID:2024
-
C:\Users\Admin\AppData\Local\Temp\5A12.tmp"C:\Users\Admin\AppData\Local\Temp\5A12.tmp"117⤵PID:4900
-
C:\Users\Admin\AppData\Local\Temp\5A9E.tmp"C:\Users\Admin\AppData\Local\Temp\5A9E.tmp"118⤵PID:2716
-
C:\Users\Admin\AppData\Local\Temp\5B5A.tmp"C:\Users\Admin\AppData\Local\Temp\5B5A.tmp"119⤵PID:1484
-
C:\Users\Admin\AppData\Local\Temp\5C06.tmp"C:\Users\Admin\AppData\Local\Temp\5C06.tmp"120⤵PID:2896
-
C:\Users\Admin\AppData\Local\Temp\5CA2.tmp"C:\Users\Admin\AppData\Local\Temp\5CA2.tmp"121⤵PID:4368
-
C:\Users\Admin\AppData\Local\Temp\5D3E.tmp"C:\Users\Admin\AppData\Local\Temp\5D3E.tmp"122⤵PID:1368
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-